22-Apr-02D.P.Kelsey, Security, UKHEP Sysman1 Grid Security 22 Apr 2002 UK HEP Sysman Meeting David Kelsey CLRC/RAL, UK

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman2 Overview What is GSI? DataGrid TB1 Security Authentication Authorisation Firewalls Operational security procedures

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman3 What is GSI? Grid Security Infrastructure See recent Globus Developers Tutorial ev-04-Security1.ppt Selected slides from this presentationSelected

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman4 DataGrid TB1 Security See documentation on EDG WP6 web site – –Usage Rules –Users Guide –Installation Guide The various installation kits do much (most?) of the work for you

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman5 Authentication Certificates Trusted Certificate Authorities Converting certificate formats Certificate Revocation Lists

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman6 Certificates Need certificates for –UsersThey request their own with Registration confirmation –HostsFor the gatekeeper –Servicese.g. LDAP/MDS

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman7 Trusted Certificate Authorities List maintained by EDG WP6 CA group Procedures and policies compared with minimum requirements Matrix of trust being created Includes USA and CrossGrid CAs Each site has the final say –But default is to accept the EDG list

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman8 Converting cert formats 2 formats:PEM and PKCS12 Extensions:.pem and.p12 Install edg-utils package –Convert PEM to PKCS12 /opt/edg/bin/grid-mk-pkcs12 –Convert PKCS12 to PEM /opt/edg/bin/pkcs12-extract Or use openssl commands (see Installation )

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman9 Certificate Revocation lists CRL Each CA maintains a signed list of revoked certificates Must be current –If not all certificates from that CA are revoked GSI checks the local copy of the CRL Must copy regularly (every day?) edg-fetch-crlto update CRLs edg-crl-upgradeddaemon to regularly update

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman10 Authorisation Usage Rules –Users sign this and no other forms –Use browser with your EDG certificate Virtual Organisations –Users need to request to join mkgridmap –Tool to create the grid mapfile Pooled accounts (gridmapdir dynamic accounts) –

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman11 EDG Authorisation grid-mapfile generation o=testbed, dc=eu-datagrid, dc=org CN=Franz Elmer ou=People CN=John Smith mkgridmap grid-mapfile VO Directory Authorization Directory CN=Mario Rossi o=xyz, dc=eu-datagrid, dc=org CN=Franz ElmerCN=John Smith Authentication Certificate ou=Peopleou=Testbed1ou=??? local usersban list

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman12 Authorisation (contd) Today can only map one certificate to one account –If need multiple roles then need more than one cert More work is still needed on –Registration Authorities for VOs –Security of VO LDAP info

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman13 Firewalls – ports used PortService 80HTTP server for Network Monitoring 123Network Time Protocol 2119Globus Gatekeeper 2135MDS info port 2169FTree info port 2170Information Index 2171FTree info port 2811GSI ftp server 3147RFIO 7771Resource Broker 7846Logging & Bookkeeping 8080Tomcat Server (R-GMA, SpitFire) 8881Job Sub. Service (client) 9991Job Sub. Service (server

22-Apr-02D.P.Kelsey, Security, UKHEP Sysman14 Operational Security Each site must nominate a Security Contact –But is there a mail list yet? Incident discovery –We need some tools/procedures (EDG WP6?) Audit logs –Grid Mapping (Gatekeeper log) –Pooled accounts –Both in syslog